1. Message Authentication and Hash Functions
Depart. of Computer Science and Engineering
刘胜利( Liu Shengli)
Tel:

2. Message Authentication
message authentication is concerned with:
protecting the integrity of a message
validating identity of originator
non-repudiation of origin (dispute resolution)
then three alternative functions used:
message encryption
message authentication code (MAC)
HMAC
Up till now, have been concerned with protecting message content (ie secrecy) by encrypting the message. Will now consider how to protect message integrity (ie protection from modification), as well as confirming the identity of the sender. Generically this is the problem of message authentication, and in eCommerce applications is arguably more important than secrecy.

3. Message Encryption
message encryption by itself also provides a measure of authentication
if symmetric encryption is used then:
receiver know sender must have created it
since only sender and receiver now key used
know content cannot of been altered
if message has suitable structure, redundancy or a checksum to detect any changes

4. Message Encryption if public-key encryption is used:
encryption provides no confidence of sender
since anyone potentially knows public-key
however if
sender signs message using their private-key
then encrypts with recipients public key
have both secrecy and authentication
again need to recognize corrupted messages
but at cost of two public-key uses on message

5. Message Authentication Code (MAC)
generated by an algorithm that creates a small fixed-sized block
depending on both message and some key
like encryption though need not be reversible
appended to message as a “signature”
receiver performs same computation on message and checks it matches the MAC
provides assurance that message is unaltered and comes from sender

6. Message Authentication Code

7. Message Authentication Codes
as shown the MAC provides authenticity
can also use encryption for secrecy
generally use separate keys for each
can compute MAC either before or after encryption
is generally regarded as better done before
why use a MAC?
sometimes only authentication is needed
sometimes need authentication to persist longer than the encryption (eg. archival use)
note that a MAC is not a digital signature

8. MAC Properties a MAC is a cryptographic checksum
MAC = CK(M)
condenses a variable-length message M
using a secret key K
to a fixed-sized authenticator
is a many-to-one function
potentially many messages have same MAC
but finding these needs to be very difficult

9. Requirements for MACs taking into account the types of attacks
need the MAC to satisfy the following:
knowing a message and MAC, is infeasible to find another message with same MAC
MACs should be uniformly distributed
MAC should depend equally on all bits of the message

10. Using Symmetric Ciphers for MACs
can use any block cipher chaining mode and use final block as a MAC
Data Authentication Algorithm (DAA) is a widely used MAC based on DES-CBC
using IV=0 and zero-pad of final block
encrypt message using DES in CBC mode
and send just the final block as the MAC
or the leftmost M bits (16≤M≤64) of final block
Can also use block cipher chaining modes to create a separate authenticator, by just sending the last block. However this suffers from being a bit too small for acceptable use today.

11. MAC based on CBC mode of DES with IV=0
Divide the message into blocks D1,D2,…Dn(padding with zero).
With K, the date authentication algorithm is
C1 = Ek(D1)
C2 = Ek(D2C1)
．．．
Cn = Ek(Dn Cn-1)
Output Cn

12. Hash Functions condenses arbitrary message to fixed size
usually assume that the hash function is public and not keyed
cf. MAC which is keyed
hash used to detect changes to message
can use in various ways with message
most often to create a digital signature

13. Hash Functions & Digital Signatures

14. Hash Function Properties
a Hash Function produces a fingerprint of some file/message/data
h = H(M)
condenses a variable-length message M
to a fixed-sized fingerprint
assumed to be public

15. Requirements for Hash Functions
can be applied to any sized message M
produces fixed-length output h
is easy to compute h=H(M) for any message M
given h is infeasible to find x s.t. H(x)=h
one-way property
given x is infeasible to find y s.t. H(y)=H(x)
weak collision resistance
is infeasible to find any x,y s.t. H(y)=H(x)
strong collision resistance
These are the specifications for good hash functions. Essentially it must be extremely difficult to find 2 messages with the same hash, and the hash should not be related to the message in any obvious way (ie it should be a complex non-linear function of the message). There are quite a few similarities in the evolution of hash functions & block ciphers, and in the evolution of the design requirements on both.

16. Use of hash functions (a) A->B: Ek(M || H(M) )
Confidentiality (A and B share K)
Authenticity (H(M) is redundant information added)
(b) A->B: M || Ek( H(M) )
authenticity
(c) A-> B: M || EKRa( H(M) )
Provide digital signature (authenticity)

17. (d) A->B: Ek(M || EKRa( H(M) ) )
Digital signature (authenticity)
confidentiality(A and B share K)
(e)A->B: M || H(M || S)
Authenticity (S is a secret shared between A and B)
(f)A->B: Ek(M || H(M || S ))
Authenticity (A and B share a secret S)
Confidentiality (A and B share K)

18. Simple Functions Compute H(M)=B1  B2 …  Bm Improvement
Divide plaintext M into blocks of size n bits, and get B1,B2,…,Bm
Compute H(M)=B1  B2 …  Bm
Improvement
H0=0;
For i=1;i<=n; i++
{ Hi-1<<1;
Hi=Bi  Hi-1}
output Hn

20. Birthday Attacks
Given x1,x2,…,xk, the probability of there exists at least two xu, xv, such that H(xu)=H(xv) is larger than 0.5?
If Hash value is of n-bit, then k is about 2n/2.
might think a 64-bit hash is secure, but by Birthday Paradox is not
birthday attack works thus:
opponent generates 2m/2 variations of a valid message all with essentially the same meaning
opponent also generates 2m/2 variations of a desired fraudulent message
two sets of messages are compared to find pair with same hash (probability > 0.5 by birthday paradox)
have user sign the valid message, then substitute the forgery which will have a valid signature
conclusion is that need to use 160-bit hash
The Birthday Attack exploits the birthday paradox – the chance that in a group of people two will share the same birthday – only 23 people are needed for a Pr>0.5 of this. Can generalize the problem to one wanting a matching pair from any two sets, and show need 2m/2 in each to get a matching m-bit hash.
Note that creating many message variants is relatively easy, either by rewording or just varying the amount of white-space in the message.

21. General structure of secure hash codeY0 Y1
YL-1 b b b n n n f n f n f
CVL
IV=
CV0
CV1
CVL-1
IV =initial value
CV = chaining value
Yi = ith input block
f = compression alg.
n = length of Hash code
b = length of input block
CV0=IV= initial n-bit value
CVi=f(CVi-1, Yi-1) (1  i  L)
H(M) = CVL

23. SHA-1 Overview pad message so its length is 448 mod 512
append a 64-bit length value to message
initialise 5-word (160-bit) buffer (A,B,C,D,E) to
( ,efcdab89,98badcfe, ,c3d2e1f0)
process message in 16-word (512-bit) chunks:
expand 16 words into 80 words by mixing & shifting
use 4 rounds of 20 bit operations on message block & buffer
add output to input to form new buffer value
output hash value is the final buffer value
Note that the SHA-1 Overview is very similar to that of MD5.

24. SHA-1 Compression Function
each round has 20 steps which replaces the 5 buffer words thus:
(A,B,C,D,E) <-(E+f(t,B,C,D)+(A<<5)+Wt+Kt),A,(B<<30),C,D)
a,b,c,d refer to the 4 words of the buffer
t is the step number
f(t,B,C,D) is nonlinear function for round
Wt is derived from the message block
Kt is a constant value derived from sin
Can see SHA shares much in common with MD4/5, but with 20 instead of 16 steps in each of the 4 rounds. Note the 4 constants are based on sqrt(2,3,5,10). Note also that instead of just splitting the input block into 32-bit words and using them directly, SHA-1 shuffles and mixes them using rotates & XOR’s to form a more complex input, and greatly increases the difficulty of finding collisions.

25. SHA-1 Compression Function

26. Keyed Hash Functions as MACs
have desire to create a MAC using a hash function rather than a block cipher
because hash functions are generally faster
not limited by export controls unlike block ciphers
hash includes a key along with the message
original proposal:
KeyedHash = Hash(Key|Message)
some weaknesses were found with this
eventually led to development of HMAC

27. HMAC specified as Internet standard RFC2104
uses hash function on the message:
HMACK = Hash[(K+ XOR opad) ||
Hash[(K+ XOR ipad)||M)]]
where K+ is the key padded out to size
and opad, ipad are specified padding constants
overhead is just 3 more hash calculations than the message needs alone
any of MD5, SHA-1, RIPEMD-160 can be used
The idea of a keyed hash evolved into HMAC, designed to overcome some problems with the original proposals. Further have a design that has been shown to have the same security as the underlying hash alg. The hash function need only be used on 3 more blocks than when hashing just the original message (for the two keys + inner hash). Choose hash alg to use based on speed/security concerns.

28. HMAC Overview

29. Construction １

30. ＨＭＡＣ Construction 2

31. HMAC Security
know that the security of HMAC relates to that of the underlying hash algorithm
attacking HMAC requires either:
brute force attack on key used
birthday attack (but since keyed would need to observe a very large number of messages)
choose hash function used based on speed verses security constraints